CSRF for spreadsheet mode